OpenSSH will unexpectedly apply settings when using Match
and not apply settings when not using Match
if at some earlier position in the configuration there is another Match block
.
The following example demonstrates this:
Match Group sudo
# this is applied to sudo members
ClientAliveInterval 20
# this is applied to sudo members
AllowTcpForwarding yes
# one might assume that the Match block has ended here - it did not
# the following is ALSO applied to sudo members only
X11Forwarding
AllowTcpForwarding no
Though most configuration is using indentation for better readability, a Match
does not end when indentation ends.
If all of the criteria on the Match line are satisfied, the keywords
on the following lines override those set in the global section of the
config file, until either another Match line or the end of the
file
OpenSSH will only notice unintended configuration changes from inappropriate Match
insertion if one of those options is not valid in that context. Otherwise, following instructions are simply becoming dependent on that Match
condition.
The unexpected configuration can be resolved by inserting all Match
blocks strictly at the very end of the configuration file - and placing all unconditional configuration strictly above the first Match
line.